Home > Vulnerability Database > CVE-2009-1838

Mend.io Vulnerability Database

CVE-2009-1838

Date: June 12, 2009

The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted event handler, related to an incorrect context for this event handler.

Severity Score

8.1

Related Resources (40)

Url: http://secunia.com/advisories/35468

Url: https://rhn.redhat.com/errata/RHSA-2009-1095.html

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2009:141

Url: http://secunia.com/advisories/35602

Url: http://www.debian.org/security/2009/dsa-1830

Url: http://secunia.com/advisories/35428

Url: http://www.vupen.com/english/advisories/2009/1572

Url: http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1

Url: http://secunia.com/advisories/35440

Url: http://secunia.com/advisories/35561

Url: http://secunia.com/advisories/35882

Url: http://www.redhat.com/support/errata/RHSA-2009-1126.html

Url: http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275

Url: https://nvd.nist.gov/vuln/detail/CVE-2009-1838

Url: https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html

Url: http://rhn.redhat.com/errata/RHSA-2009-1096.html

Url: http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408

Url: https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00444.html

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=489131

Url: http://secunia.com/advisories/35536

Url: http://secunia.com/advisories/35415

Url: http://www.redhat.com/support/errata/RHSA-2009-1125.html

Url: http://secunia.com/advisories/35439

Url: http://www.debian.org/security/2009/dsa-1820

Url: http://www.securitytracker.com/id?1022397

Url: https://bugzilla.redhat.com/show_bug.cgi?id=503580

Url: https://access.redhat.com/security/cve/CVE-2009-1838

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11080

Url: http://www.securityfocus.com/bid/35383

Url: http://secunia.com/advisories/35331

Url: http://secunia.com/advisories/35431

Url: http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468

Url: http://www.securityfocus.com/bid/35326

Url: http://www.mozilla.org/security/announce/2009/mfsa2009-29.html

Url: http://www.ubuntu.com/usn/usn-782-1

Url: http://osvdb.org/55157

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2009-1838

Url: https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00504.html

Url: https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html

Url: https://www.mend.io/vulnerability-database/CVE-2009-1838

Severity Score

8.1

Weakness Type (CWE)

Improper Control of Generation of Code ('Code Injection')

CWE-94

CVSS v3.1

Base Score:	8.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	9.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	COMPLETE
Integrity (I):	COMPLETE
Availability (A):	COMPLETE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2009-1838

Date: June 12, 2009

Severity Score

Related Resources (40)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?